Use Intune Remote Help for Secure Remote Support

In this lab, you will configure Intune Remote Help, deploy the Remote Help app, set up RBAC permissions for help desk staff and test real‑world remote support scenarios using both admin and restricted agent roles.

Intune

Scenario

A growing organisation wants to modernise its remote support capabilities. Traditional remote‑control tools lack integration with identity, auditing, and access control. The IT team is exploring Intune Remote Help, a cloud‑based support tool that integrates directly with Entra ID and Intune.

Your task is to configure Remote Help, deploy the client app, set up help desk roles with different permission levels and test the end‑user experience from both the helper and sharer perspectives.

Lab Objectives

By the end of this lab, you will be able to:

  • Enable and configure Intune Remote Help at the tenant level.
  • Package and deploy the Remote Help app using Intune Win32 app deployment.
  • Create RBAC roles for help desk admins and help desk agents.
  • Test remote support sessions with full‑control and view‑only permissions.
  • Review Remote Help logs and auditing information.

Prerequisites

  • Microsoft 365 tenant
  • Intune and Entra ID Premium licenses
  • Remote Help add‑on licenses for helpers and sharers
  • Two Windows 10 devices (latest version), Entra joined and Intune enrolled
  • Administrator permissions for setup

Enable Remote Help in Intune

Turn on the Remote Help service for the entire tenant.

  1. Go to Intune Admin Center → Tenant Administration → Remote Help.
  2. Select Settings → Configure.
  3. Enable Remote Help.
  4. (Optional) Enable Allow Remote Help for unenrolled devices.

Verification
Remote Help shows as Enabled in the tenant settings.

Download and Prepare the Remote Help App

The Remote Help client must be installed on every helper and sharer device.

  1. Download the Remote Help installer (EXE) from Microsoft.
  2. Note the file version required for Intune detection rules.
  3. Rename the EXE for easier management.
  4. Download the Win32 Content Prep Tool.
  5. Create a folder (e.g., C:\App) and place both files inside.
  6. Run the prep tool to convert the EXE into a .intunewin package.

Verification
A .intunewin file is generated in the output folder.

Deploy the Remote Help App Using Intune

Add the packaged app to Intune and configure installation rules.

  1. Go to Apps → Windows → Add → Win32 App.
  2. Upload the .intunewin package.
  3. Configure:
    • Install command:
      remotehelpinstaller.exe /quiet acceptTerms=1
    • Uninstall command:
      remotehelpinstaller.exe /quiet uninstall=1
  4. Set:
    • Architecture: 64‑bit
    • Minimum OS: Windows 10 22H2
  5. Create a File Detection Rule:
    • Path: installation directory
    • File: remotehelp.exe
    • Detection method: String
    • Version: (use the version noted earlier)
  6. Assign the app to All Devices.

Verification
Devices begin installing the Remote Help app and show it as Installed in Intune.

Create RBAC Roles for Help Desk Admins

Admins require full control during remote sessions.

  1. Create a Security Group named Help Desk Admins.
  2. Add members.
  3. Go to Tenant Administration → Roles.
  4. Assign the Help Desk Operator built‑in role.
  5. Confirm permissions include:
    • View Screen
    • Elevation
    • Full Control

Verification
The Help Desk Admin group appears under the role assignment.

Create RBAC Roles for Help Desk Agents (View‑Only)

Agents should only be able to view the user’s screen.

  1. Create a Security Group named Help Desk Agents.
  2. Add members.
  3. Assign the Read‑Only Operator built‑in role.
  4. Create a Custom Role:
    • Enable only:
      • View Screen
      • Offer Remote Assistance
  5. Assign the custom role to the Help Desk Agents group.

Verification
The custom role shows only the restricted permissions.

Review Remote Help Logs and Auditing

Intune provides built‑in auditing for all remote sessions.

  1. Go to Tenant Administration → Audit Logs.
  2. Review Remote Help entries.
  3. Go to Remote Help → Sessions to view:
    • Device name
    • Helper
    • Sharer
    • Session duration
  4. On the device, open Event Viewer → Applications and Services Logs → RemoteHelp.

Verification
Remote Help session logs appear in both Intune and Event Viewer.

Test Remote Help as a Help Desk Admin

Admins should have full control.

  1. Log in as the admin user.
  2. Open Intune Admin Center → Devices → Windows.
  3. Select Workstation01.
  4. Choose New Remote Assistance Session.
  5. On the user’s device, accept the connection.
  6. In the Remote Help app, test:
    • Laser pointer
    • Annotation
    • Chat
    • Request Full Control

Verification
Full control is granted after the user approves the request.

Test Remote Help as a Help Desk Agent

Agents should only have view‑only access.

  1. Log in as a standard user.
  2. Open Intune Admin Center → Devices.
  3. Select Workstation01.
  4. Start a Remote Help session.
  5. On the user’s device, accept the connection.
  6. Confirm:
    • Full control option is not available
    • Only view screen, annotation, laser pointer, and chat are allowed

Verification
The agent cannot request or take full control.

Conclusion

In this lab, you successfully configured Intune Remote Help, deployed the Remote Help client and implemented RBAC permissions for different help desk roles. You tested real‑world support scenarios and confirmed that Remote Help integrates seamlessly with Entra ID authentication, provides clear user prompts and supports detailed auditing.

While licensing costs may be a consideration, the security, control and centralised management make Remote Help a strong solution for enterprise support environments.

Lab Video

Watch On YouTube
Get NordVPN